146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b

General

Target

146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
Size

76KB
MD5

6a0a5e04a3e17f5ae70bf43245269d69
SHA1

1c0a120a5277df858bb06cbc35390336f059c379
SHA256

146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b
SHA512

ead9415b359e0dcd2bda113ce113dcd27aae9f19eb42c7d9cda4f91b3f9e7a4bc9a7646fa57df7ac03548b9f160f7d33995fd1174faac71da15b2673f929a868
SSDEEP

1536:W7ZhA7pApvOsOKjC0YSilpFpfkJOM2kJOMIsKsc696a:6e7WpXYvnda

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5185) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_1.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.Windows.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Excel.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.png.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Java\jre-1.8\lib\logging.properties.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-pl.xrm-ms.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN107.XML.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationProvider.resources.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicudt53_64.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN097.XML.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-phn.xrm-ms.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_EN.LEX.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\catalog.json.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationTypes.resources.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\en-GB.pak.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\MySite.ico.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\lv.pak.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll.tmp	146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe

C:\Users\Admin\AppData\Local\Temp\146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe
"C:\Users\Admin\AppData\Local\Temp\146d7b7d8eb8e2d57de539af49164723e40b196b7654a831e342aa760b46418b.exe"
1⤵
- Drops file in Program Files directory
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4244,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:8
1⤵
PID:3624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Filesize
76KB

MD5
2a1063b6ab23a425e4671514ddf896c3

SHA1
4748407c24a472054ac84e6c398297c06b546915

SHA256
17c1362b461c4a278186444554a13530005d7921cbe7d19e35c00cf493bd9dce

SHA512
09eec01504e60c87ca8b81fef7a4d590f379757c473f167609896800946b7d90462d7b322be0b80b95e7325713831f2ce17fe71d555717716e36427cc11986a1

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp
Filesize
189KB

MD5
54a9b7f7e5027184c9040bf981e2dcc4

SHA1
7a9fef01d5f961a250e983b8b940027e5aa931da

SHA256
194c47c555a991d8c6028bb0022b30a2311aac66021234dbb9718590ac785337

SHA512
e09a9be2125b942a61623965ab2220782c9ef9fd7b6b1aced139216bae842060b18503d7407de33da796582b799c4f96a0dfa6ee7caf5a054dffb359e05f21e1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads